docs(designs): scrub the private repo's former name and gate it (RIG-3756)

.moon/workspace.yml

@@ -86,11 +86,10 @@ projects:
   stamp-gate: 'tools/stamp-gate'
   # The design-ledger gate: validates the Compass design-decision ledger
   # (docs/designs/DECISIONS.md), the per-record `Status:` headers, and
-  # dangling supersession/Record pointers (RIG-1187). Migrated from the sealed
-  # repo with the corpus it governs (RIG-1794).
+  # dangling supersession/Record pointers (RIG-1187).
   design-ledger-gate: 'tools/design-ledger-gate'
   # The orion-ref-gate boundary gate (RIG-2489): fail-closed scan that the PUBLIC
-  # compass repo carries no reference to the PRIVATE internal monorepo. Mirrors
+  # compass repo carries no out-of-tree reference the managed boundary forbids. Mirrors
   # design-ledger-gate; registered here so its check + typecheck + unit test run
   # in the moon-driven CI sweep — unregistered, moon never discovers it and the
   # boundary re-rots uncaught.
@@ -138,7 +137,7 @@ projects:
   # silently inert (moon discovers projects only from this map) and the config
   # drift it fences ships uncaught.
   renovate: 'tools/renovate'
-  # The Renovate preflight probe (ported from the internal monorepo's preflight probe):
+  # The Renovate preflight probe:
   # checks the minted App token can see the repo before `bunx renovate` runs,
   # failing fast with a named diagnosis instead of Renovate's opaque
   # platform-unknown-error. Registered so its own typecheck + unit test gate.

apps/eng-docs/moon.yml

@@ -5,7 +5,7 @@
 # devenv toolchain on PATH. install/lint/format are inherited (bun tag →
 # root:install; biome + markdownlint are the root whole-repo sweep, which lints
 # the canonical docs/ sources — the generated src/content/docs/ mirror is
-# gitignored and exempt). Public counterpart to sealed/apps/docs: no Cloudflare
+# gitignored and exempt). Unlike the prior art's docs app: no Cloudflare
 # Access gate, no PostHog analytics.
 workspace:
   inheritedTasks:

apps/eng-docs/scripts/deploy.ts

@@ -5,8 +5,8 @@
 // GitHub Actions workflow (RIG-1765). The engineering docsite lives on
 // Cloudflare Pages under the compass-eng-docs project.
 //
-// Adapted from sealed apps/docs/scripts/deploy.ts — they share the same
-// Cloudflare Pages deploy + PR-preview-comment shape and the three constants
+// Shares the same Cloudflare Pages deploy + PR-preview-comment shape as the
+// prior art, including the three constants
 // below (PROJECT_NAME, COMMENT_MARKER, SITE_LABEL). This docsite build gathers
 // the compass repo's markdown, so its preview comment also deep-links the .md
 // pages a PR changed (changedDocPages + commentBody's "Changed pages" section).

docs/designs/CONTRIBUTING.md

@@ -7,7 +7,7 @@ a form they did not intend to publish.
 
 These five rules are the standing policy for every design record authored here
 going forward. Rules 1-4 match the sanitization the one-shot migration applied
-to the records imported from the private `sealed` repo (new records should be
+to records imported from out of tree (new records should be
 written this way from the start so they need no migration); rule 5 governs what
 happens to a record's inbound links when another record is deleted.
 
@@ -26,8 +26,8 @@ harmless. A dead `linear.app` URL is worse than no URL.
 
 ## 2. No `oss/compass/` path prefixes
 
-The private repo vendored Compass under `oss/compass/`. This repo **is** that
-tree, without the prefix. Cite paths relative to the repo root:
+Some imported records cite Compass paths under an `oss/compass/` prefix. This
+repo **is** that tree, without the prefix. Cite paths relative to the repo root:
 
 - `oss/compass/go/internal/runtime/image.go` → `go/internal/runtime/image.go`
 - `oss/compass/apps/ui/src/stub-data.ts` → `apps/ui/src/stub-data.ts`

docs/designs/agent/compass-agent-container-runtime.md

@@ -485,7 +485,7 @@ transcript-scoped, not container-scoped.)
 
 ### Spec impact — supersession, by citation
 
-Per the sealed frozen-record convention, merged records are never edited;
+Per the frozen-record convention, merged records are never edited;
 this record supersedes specific claims by citing them, and the **impl PR's
 living-spec update** carries the replacement into
 `docs/specs/product/compass.md`:

docs/designs/agent/compass-forks-reversal/design.md

@@ -23,7 +23,7 @@ machinery that existed only to carry them.
 
 - **FROZEN (Matt, 2026-08-19): shared `RigelBuild/{devenv,nix2container,oh-my-pi}`
   repos + combined patch work.** Compass consumes the shared canonical fork
-  repos — one canonical fork per upstream. Sealed patches useful to both the
+  repos — one canonical fork per upstream. Patches useful to both the
   fleet and compass land in the shared repos, never duplicated. Do
   not relitigate; tasks execute it.
 - **Shared-repo patch ownership is disjoint (forge coordination, 2026-08-19).**
@@ -133,7 +133,7 @@ is compass's review point — not a mechanical path swap.
   `moon.yml` check task carries `/forks/devenv/**` as an affected-detection
   input glob (`agent-image-env-gate/moon.yml:58`).
 
-**The sealed patch is compass-specific and load-bearing.** All of it sits in
+**The `containers.nix` patch is compass-specific and load-bearing.** All of it sits in
 `forks/devenv/src/modules/containers.nix`:
 
 - Per-container `user`/`group`/`homeDir` options (`containers.nix:373` —
@@ -154,7 +154,7 @@ UPSTREAM (verified 2026-08-19 against `RigelBuild/devenv@afed7bf3`
 `src/modules/containers.nix`: `homeDir = "/env";` hardcoded in a module-scope
 `let`, `envContainerName = builtins.getEnv "DEVENV_CONTAINER"` present, no
 per-container identity options). The shared `RigelBuild/devenv` fork carries no
-sealed diff for this and has no devenv consumer of its own. Per Matt's ruling,
+diff for this and has no devenv consumer of its own. Per Matt's ruling,
 compass's `containers.nix` patch set therefore **lands INTO `RigelBuild/devenv`
 first** (harmless to other consumers, required by compass), and only then does
 compass repoint to `github:RigelBuild/devenv`. A naive repoint before the patch
@@ -177,7 +177,7 @@ rationale.
   path:../forks/nix2container#skopeo-nix2container`. The env-gate also globs
   `/forks/nix2container/**` (`agent-image-env-gate/moon.yml:59`).
 
-**The sealed patch is shared.** `forks/nix2container/default.nix:396-399` drops
+**This patch is shared.** `forks/nix2container/default.nix:396-399` drops
 relocated copyToRoot paths from the initialized nix DB:
 
 ```nix
@@ -216,9 +216,9 @@ merge and the rev were re-verified at source before this fold.)
 ### oh-my-pi
 
 **Consumer shape: no *build* consumer, one *tooling* consumer.** The tree is
-plain upstream at tag `v17.1.8` with no sealed diff (`forks/README.md:151-155` —
-"Sealed changes: NONE … verified byte-identical to `can1357/oh-my-pi` at
-`v17.1.8`"); no compass image or app build consumes it (`forks/README.md:214`).
+plain upstream at tag `v17.1.8` with no local diff at all — verified
+byte-identical to `can1357/oh-my-pi` at `v17.1.8` — and no compass image or
+app build consumes it.
 But it is **not** consumer-free: the store door's credential-denylist generator
 reads the subtree directly — `go/internal/store/gen_credential_keys.go:42`
 (`const schemaRelPath = "../../../forks/oh-my-pi/packages/coding-agent/src/config/settings-schema.ts"`),
@@ -244,7 +244,7 @@ removes 5892 of the 7424 vendored files in one move. The one real consumer —
 the generator — should read the npm-installed schema the agent actually runs
 (`packages/compass-agent/node_modules/@oh-my-pi/pi-coding-agent/src/config/settings-schema.ts`, pinned
 at `packages/compass-agent/package.json:19`), so the denylist tracks the version
-in production rather than a vendored snapshot. The sealed deltas catalogued in
+in production rather than a vendored snapshot. The deltas catalogued in
 `forks/README.md:156-197` live in the monorepo fork and are
 `RigelBuild/oh-my-pi`'s concern, not compass's. Drop-vs-consume is a
 load-bearing Open Question (OQ1) — but the one real consumer wanting the npm
@@ -272,7 +272,7 @@ this record does not require it.
 - **Compass-own fork repos** (`RigelBuild/compass-devenv` etc., or reviving the
   per-upstream Copybara spoke repos) — rejected. Matt ruled shared canonical
   repos: one fork per upstream, patch work combined. Two forks of the same
-  upstream would duplicate the sealed patches and re-create the divergence this
+  upstream would duplicate the patch work and re-create the divergence this
   reversal exists to end. Frozen; not relitigated here.
 - **Defer until the fleet's reversal fully lands** — rejected. Only
   the nix2container lane has a genuine cross-repo dependency (the shared
@@ -304,7 +304,7 @@ Contribute compass's devenv patch set into `RigelBuild/devenv`, and confirm the
 nix2container shared fix has landed.
 
 - **L0a — land the `containers.nix` patch in `RigelBuild/devenv`.** Port the
-  full sealed diff from `forks/devenv/src/modules/containers.nix` (per-container
+  full diff from `forks/devenv/src/modules/containers.nix` (per-container
   `user`/`group`/`homeDir` options with upstream values as defaults,
   `containers.nix:373-389`; the `$HOME`-staging guard; the `imageEnv`
   DEVENV_-filter, `containers.nix:181`; the config-only `buildingContainer`
@@ -342,7 +342,7 @@ nix2container shared fix has landed.
 
 Interfaces:
 
-- Consumes: `forks/devenv/src/modules/containers.nix` (the sealed diff, source
+- Consumes: `forks/devenv/src/modules/containers.nix` (the diff, source
   of truth for L0a); the shared nix-DB-drop fix on `RigelBuild/nix2container`.
 - Produces: `RigelBuild/devenv` `main` rev carrying the patch;
   `RigelBuild/nix2container` `master` rev carrying the shared fix. These two

docs/designs/agent/compass-manager-comms-substrate/design.md

@@ -292,7 +292,7 @@ DL-054 amendment).
 
 Every task below inherits these; task briefs do not restate them.
 
-- **Two-repo split.** This record lives in `sealed` (design corpus);
+- **Two-repo split.** This design corpus lives out of tree;
   implementation lands in `RigelBuild/compass`. All file:line citations
   below are into the compass clone.
 - **Additive-only proto changes.** New fields, new enum values, new RPCs, new

docs/designs/infra/ci/compass-agent-image-publish/design.md

@@ -8,10 +8,10 @@ Tracking: RIG-1690 (blocks compass-native RIG-1683/T2, RIG-1685/T4, RIG-1687/T6)
 > `agent-image/*`, `.github/workflows/*`, `forks/*`, `go/cmd/*`, `ci.yml`,
 > `devenv.nix`, `packages/compass-agent/*`, and `docs/architecture/*` citation
 > below is a path in that repo at HEAD `b3fc25311`, not this one (line numbers
-> drift as the code evolves; resolve them against that commit). It lives in the
-> sealed design corpus (`docs/designs/infra/ci/`) because that is where the wave's design
+> drift as the code evolves; resolve them against that commit). It lives out of
+> tree because that is where the wave's design
 > records freeze; the `docs/designs/ui/*` cross-references (e.g. DL-112)
-> are paths in this (sealed) corpus.
+> are paths in this corpus.
 >
 > **Superseded in part** (RIG-1746, Matt 2026-08-25): the *CI-placement*
 > decision below — a separate `.github/workflows/publish-agent-image.yml`
@@ -517,11 +517,11 @@ Interfaces:
 
 ## Open Questions
 
-- **[Resolved] Record placement.** This record lives in the sealed design
-  corpus (`docs/designs/infra/ci/`), the wave's canonical home for frozen
+- **[Resolved] Record placement.** This record lives out of tree,
+  the wave's canonical home for frozen
   design records, beside the other `compass-*` records. T4 folds the durable
   operational content into the compass repo's `docs/architecture/build-and-ci.md`
-  once implemented; this record stays the design of record in sealed.
+  once implemented; this record stays the design of record out of tree.
 - **[Non-load-bearing] GA release tag.** RIG-1687 will likely want
   `:v<semver>` alongside `:git-<sha>`; T1's tag-list CLI makes that a
   no-redesign later add. Deferred to GA planning.

docs/designs/infra/ci/compass-dogfood-e2e-steer-deliver-seam/design.md

@@ -278,7 +278,7 @@ In dependency order — T2 depends on T1, T3 on T1+T2.
     (window-scoped to each recipient's turn settle): peer-1 no `deliver`, spawner
     no `steer` for that id.
 
-Note on ledgers: this record lives in the sealed platform design corpus
+Note on ledgers: this record lives out of tree
 (`docs/designs/platform/`), which the design-ledger-gate governs only for the
 **product** corpus (`docs/designs/product/DECISIONS.md`). A platform record adds
 no DECISIONS row and declares no ledger delta, mirroring its frozen parent

docs/designs/infra/ci/compass-dogfood-e2e/design.md

@@ -11,7 +11,7 @@ Status: Draft
 > for the Dogfood milestone. The design targets the **`RigelBuild/compass`**
 > repo; every `go/*`, `proto/*`, `packages/*`, `apps/*`, and `devenv.nix:*`
 > citation below is a path in that repo at origin/main HEAD `abdb412c`, not
-> this one. It lives in the sealed design corpus because that is where the
+> this one. It lives out of tree because that is where the
 > wave's design records freeze.
 
 ## Problem / Intent
@@ -45,7 +45,7 @@ messaging with @mention delivery, (5) teardown + resume from durable state —
 becomes the first scenario set authored on the harness and remains the
 concrete Dogfood acceptance gate.
 
-Note on ledgers: this record lives in the sealed design corpus
+Note on ledgers: this record lives out of tree
 (`docs/designs/platform/`), which the design-ledger-gate governs only for the
 **product** corpus (`docs/designs/product/DECISIONS.md`). A platform record
 adds no DECISIONS row and declares no ledger delta, so nothing here is

docs/designs/infra/ci/compass-dogfood-loop/design.md

@@ -8,7 +8,7 @@ Status: Active
 > end to end. The design targets the **`RigelBuild/compass`** repo (its
 > `devenv.nix`, `agent-image/`, and `go/cmd/*` binaries); every `devenv.nix:*`,
 > `agent-image/*`, and `go/cmd/*` citation below is a path in that repo at HEAD
-> `21241f720`, not this one. It lives in the sealed design corpus because that is
+> `21241f720`, not this one. It lives out of tree because that is
 > where the wave's design records freeze.
 
 ## Problem / Intent
@@ -26,7 +26,7 @@ self-signed cert) and idles, and a real session is driven end to end
 (`CommsService.CreateAgent` → `CompassService.ProvisionAgentWorkspace` →
 `StartAgentSession`), so a real container spawns and runs an agent turn.
 
-Note on ledgers: this record lives in the sealed design corpus
+Note on ledgers: this record lives out of tree
 (`docs/designs/platform/`), which the design-ledger-gate governs only for the
 **product** corpus (`docs/designs/product/DECISIONS.md`). A platform record adds
 no DECISIONS row and declares no ledger delta, so nothing here is ledger-tracked;

docs/designs/meta/compass-design-ledger/design.md

@@ -203,7 +203,7 @@ fast-follow diff-aware core promotes it to gate-checked (merge-base compare).
 ### 4. The workflow rule — same-PR ledger flip + code-comment citation
 
 The ledger is the ONE living exception to freeze-on-merge, BY DESIGN. It
-stays consistent with the freeze model the same way specs do — the sealed
+stays consistent with the freeze model the same way specs do — the
 convention "update the matching `docs/specs/` doc *in the same PR* as the
 code" (`AGENTS.md:73-74`) extends to the ledger: **the PR that freezes a
 record also appends its new decision rows and flips any rows it supersedes.**

docs/designs/repo/compass-design-docs-reorg/design.md

@@ -27,7 +27,7 @@ this record). Two problems:
    also collides with the fleet-wide sense of "platform" (the shared
    infrastructure layer), making it doubly ambiguous in a product repo. The
    bucket is an accident of migration: the eng-docs migration record itself asserted
-   "`platform/` — a sealed-monorepo domain — does not exist in compass"
+   "`platform/` — an out-of-tree domain — does not exist in compass"
    (`docs/designs/repo/compass-eng-docs/design.md:386-387`), yet 17 records now
    live there.
 
@@ -205,7 +205,7 @@ docs/designs/platform/compass-renovate-migration.md"), `buf.gen.yaml:9`,
 `packages/compass-agent/src/transport/*` file comments, and gate/test fixtures
 (`tools/design-ledger-gate/index.test.ts`, `tools/orion-ref-gate/index.test.ts`
 — fixture strings, not live paths). Inside the corpus, 41 more `docs/designs/platform`
-prose citations. Two cited paths are **already dead** (sealed-repo records that
+prose citations. Two cited paths are **already dead** (out-of-tree records that
 never migrated, pre-existing rot, out of scope but noted): `buf.gen.yaml:9`
 (`docs/designs/platform/go-toolchain-default.md`) and `devenv.nix:208`
 (`docs/designs/platform/ci-toolchain-shared-defs.md`).
@@ -486,8 +486,8 @@ the gate expansion it forces, and the migration strategy:
    *metadata* edits ride the same standard: Status-header normalization to the
    gate grammar (`index.ts:87`) for newly-governed records, and one-line
    corrections of a record's stale self-described location
-   (`compass-agent-image-publish.md:8-11,500-504` says it "lives in the sealed
-   design corpus") — location metadata and machine-checked headers, not
+   (`compass-agent-image-publish.md:8-11,500-504` says it "lives out of tree")
+   — location metadata and machine-checked headers, not
    decisions.
 
 ## Alternatives considered
@@ -849,8 +849,8 @@ Interfaces:
 ### T9 — Post-move verification sweep
 
 Repo-wide grep proves zero live references to `docs/designs/platform/` (the
-two pre-existing dead sealed citations `buf.gen.yaml:9` / `devenv.nix:208` are
-re-pointed to prose or left with an explicit "sealed-private" annotation —
+two pre-existing dead citations `buf.gen.yaml:9` / `devenv.nix:208` are
+re-pointed to prose or left with an explicit "out-of-tree" annotation —
 executor's call, flagged in the PR) and that the only remaining
 `docs/designs/product/` paths are the T10-deferred native-family records and
 their Record cells. Docsite build renders every record; spot-check routes for